tools: suppress ctime() error from static analysers

This function is not thread safe and can be easily misused
even in single threaded scenarios (one such minor bug fixed).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

diff --git a/src/certtool.c b/src/certtool.c
index 6623b86385a3d88c4fe27874624a2fd39b25c288..f34f7d4573a89cf089289263a04079e5826606dc 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -325,6 +325,7 @@ generate_certificate(gnutls_privkey_t * ret_key,
        unsigned int usage = 0, server, ask;
        gnutls_x509_crq_t crq;  /* request */
        unsigned pk;
+       char timebuf[SIMPLE_CTIME_BUF_SIZE];
 
        ret = gnutls_x509_crt_init(&crt);
        if (ret < 0) {
@@ -439,8 +440,8 @@ generate_certificate(gnutls_privkey_t * ret_key,
 
                if (ca_crt && (secs > gnutls_x509_crt_get_expiration_time(ca_crt))) {
                        time_t exp = gnutls_x509_crt_get_expiration_time(ca_crt);
-                       fprintf(stderr, "\nExpiration time: %s", ctime(&secs));
-                       fprintf(stderr, "CA expiration time: %s", ctime(&exp));
+                       fprintf(stderr, "\nExpiration time: %s\n", simple_ctime(&secs, timebuf));
+                       fprintf(stderr, "CA expiration time: %s\n", simple_ctime(&exp, timebuf));
                        fprintf(stderr, "Warning: The time set exceeds the CA's expiration time\n");
                        ask = 1;
                }
@@ -2652,12 +2653,13 @@ static void print_pkcs7_sig_info(gnutls_pkcs7_signature_info_st *info, common_in
        gnutls_datum_t data;
        char prefix[128];
        int ret;
+       char timebuf[SIMPLE_CTIME_BUF_SIZE];
 
        print_dn("\tSigner's issuer DN", &info->issuer_dn);
        print_raw("\tSigner's serial", &info->signer_serial);
        print_raw("\tSigner's issuer key ID", &info->issuer_keyid);
        if (info->signing_time != -1)
-               fprintf(outfile, "\tSigning time: %s", ctime(&info->signing_time));
+               fprintf(outfile, "\tSigning time: %s\n", simple_ctime(&info->signing_time, timebuf));
 
        fprintf(outfile, "\tSignature Algorithm: %s\n", gnutls_sign_get_name(info->algo));
 

diff --git a/src/common.c b/src/common.c
index 664513c9ad42cbb765e7c48bd592c241cf48aa01..433e31ac9016a338bc22a0436258b590c4abe362 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -1199,3 +1199,22 @@ void log_set(FILE *file)
 {
        logfile = file;
 }
+
+/* This is very similar to ctime() but it does not force a newline.
+ */
+char *simple_ctime(const time_t *t, char out[SIMPLE_CTIME_BUF_SIZE])
+{
+       struct tm tm;
+
+       if (localtime_r(t, &tm) == NULL)
+               goto error;
+
+       if (!strftime(out, SIMPLE_CTIME_BUF_SIZE, "%c", &tm))
+               goto error;
+
+       return out;
+
+ error:
+       snprintf(out, SIMPLE_CTIME_BUF_SIZE, "[error]");
+       return out;
+}

diff --git a/src/common.h b/src/common.h
index 40f16451ae54f16db11f2644de4e19e3b0531d2e..884a355a8286a7873a29a9bfeb951c10bfaf736a 100644 (file)
--- a/src/common.h
+++ b/src/common.h
@@ -144,4 +144,7 @@ void set_read_funcs(gnutls_session_t session)
 # define set_read_funcs(x)
 #endif
 
+#define SIMPLE_CTIME_BUF_SIZE 64
+char *simple_ctime(const time_t *t, char buf[SIMPLE_CTIME_BUF_SIZE]);
+
 #endif /* GNUTLS_SRC_COMMON_H */

diff --git a/src/ocsptool-common.c b/src/ocsptool-common.c
index dd9dc2dc8de3bc1dfbd425d2790163bc35d1a924..4286e1484c0390bea07b576640a88d991d8f2044 100644 (file)
--- a/src/ocsptool-common.c
+++ b/src/ocsptool-common.c
@@ -335,6 +335,8 @@ check_ocsp_response(gnutls_x509_crt_t cert,
        int ret;
        unsigned int status, cert_status;
        time_t rtime, vtime, ntime, now;
+       char timebuf1[SIMPLE_CTIME_BUF_SIZE];
+       char timebuf2[SIMPLE_CTIME_BUF_SIZE];
 
        now = time(0);
 
@@ -395,7 +397,7 @@ check_ocsp_response(gnutls_x509_crt_t cert,
        }
 
        if (cert_status == GNUTLS_OCSP_CERT_REVOKED) {
-               printf("*** Certificate was revoked at %s", ctime(&rtime));
+               printf("*** Certificate was revoked at %s\n", simple_ctime(&rtime, timebuf1));
                ret = 0;
                goto cleanup;
        }
@@ -403,17 +405,16 @@ check_ocsp_response(gnutls_x509_crt_t cert,
        if (ntime == -1) {
                if (now - vtime > OCSP_VALIDITY_SECS) {
                        printf
-                           ("*** The OCSP response is old (was issued at: %s) ignoring",
-                            ctime(&vtime));
+                           ("*** The OCSP response is old (was issued at: %s) ignoring\n",
+                            simple_ctime(&vtime, timebuf1));
                        ret = -1;
                        goto cleanup;
                }
        } else {
                /* there is a newer OCSP answer, don't trust this one */
                if (ntime < now) {
-                       printf
-                           ("*** The OCSP response was issued at: %s, but there is a newer issue at %s",
-                            ctime(&vtime), ctime(&ntime));
+                       printf("*** The OCSP response was issued at: %s but there is a newer issue at %s\n",
+                               simple_ctime(&vtime, timebuf1), simple_ctime(&ntime, timebuf2));
                        ret = -1;
                        goto cleanup;
                }
@@ -445,8 +446,8 @@ check_ocsp_response(gnutls_x509_crt_t cert,
        }
 
  finish_ok:
-       printf("- OCSP server flags certificate not revoked as of %s",
-              ctime(&vtime));
+       printf("- OCSP server flags certificate not revoked as of %s\n",
+              simple_ctime(&vtime, timebuf1));
        ret = 1;
  cleanup:
        gnutls_ocsp_resp_deinit(resp);

diff --git a/src/pkcs11.c b/src/pkcs11.c
index bb4acd66cefe1973b48df3ff097d9758567112e7..d938231c35daa58726a0b6a075f86735484dd175 100644 (file)
--- a/src/pkcs11.c
+++ b/src/pkcs11.c
@@ -281,6 +281,7 @@ pkcs11_list(FILE * outfile, const char *url, int type, unsigned int flags,
                unsigned int oflags;
                const char *vendor;
                char *objurl;
+               char timebuf[SIMPLE_CTIME_BUF_SIZE];
 
                ret =
                    gnutls_pkcs11_obj_export_url(crt_list[i], detailed,
@@ -326,7 +327,7 @@ pkcs11_list(FILE * outfile, const char *url, int type, unsigned int flags,
                }
 
                if (otype == GNUTLS_PKCS11_OBJ_X509_CRT && exp != -1) {
-                       fprintf(outfile, "\tExpires: %s", ctime(&exp));
+                       fprintf(outfile, "\tExpires: %s\n", simple_ctime(&exp, timebuf));
                }
 
                gnutls_free(output);

diff --git a/src/serv.c b/src/serv.c
index 0866bff903c0992f54cc5906528476ea6bed4074..fbb40258a5a4550e0a81536049b62973bcdffa47 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -1451,6 +1451,7 @@ static void tcp_server(const char *name, int port)
                                if (accept_fd < 0) {
                                        perror("accept()");
                                } else {
+                                       char timebuf[SIMPLE_CTIME_BUF_SIZE];
                                        time_t tt = time(0);
                                        char *ctt;
 
@@ -1472,7 +1473,7 @@ static void tcp_server(const char *name, int port)
                                        j->close_ok = 0;
 
                                        if (verbose != 0) {
-                                               ctt = ctime(&tt);
+                                               ctt = simple_ctime(&tt, timebuf);
                                                ctt[strlen(ctt) - 1] = 0;
 
                                                printf